How to install and configure iDRAC Service Module?
The Integrated Dell Remote Access Controller(iDRAC) Service Module is a lightweight optional software application that can be installed on Dell 12G Server or later. The iDRAC Service Module complements iDRAC interfaces – Graphical User Interface (GUI), RACADM CLI and Web Service Management (WSMAN) with additional monitoring data. You can configure the features on the supported operating system depending on the features to be installed and the unique integration needs in a work environment.
The iDRAC Service Module architecture uses IP socket communication and provides additional Server Management data (OS/device driver) to iDRAC and presents one-to-many consoles with access to Systems Management data through OS standard interfaces.
For more information, see the following video tutorials.
Please supply ESX installation and configuration information. I have the IDRAC service module installed but don't know how to configure it with regards to the iDrac network on the ESX host.
I have tested version 2.1.0 on RHEL6. It has created a network device named 'idrac' that allowed ssh connections to the iDRAC service processor from the host system, circumventing the network security gained from putting the service processor on a separate network. Is there a way to prevent this?
The network between iDRAC Service Processor and Host operating system is secured. Any device from host network or iDRAC network can not access this network device externally
You really need to take a hard look at iDrac/host separation. Start with the assumption that the host is compromised and how that affects what can be done to the iDrac network.
Then do some hard thinking about what firmwares a compromised host can change (including disks).
Suggestions:
- Updating iDrac from host should be disabled physically.
- Switches: Make is possible to do private vlans where a port can be configured to make a tagged vlan the isolated one. This way we can put the idrac on a vlan and still share the ports. The idrac will be in a PVLAN where it only can talk to the management servers.
- Consider: If the host is compromised, is the only sane thing to do to bin the server? Is there a backdoor in a firmware?
cameronredux
2 Intern
•
615 Posts
98649
0
Posted April 23rd, 2014 11:00
Where is the link to the download for iDRAC Service Module?
Is there a non microsoft OS version? :)